Using Additional Features for Role Maintenance

Objective

After completing this lesson, you will be able to utilize Additional Reports for Role Maintenance.

New Features for Role Maintenance

Overview

Table showing new features for Role Maintenance.

Update of Application Groups in Role Menu

You have inserted application groups (for example, SAP Fiori tile catalogs) into the menu of roles. The applications contained in the application groups were also included in the role menu as sub nodes of the groups. If you add applications to a group or delete applications from a group, you must update the role menu.

Screenshots showing update of application groups in role menu for PFCG.

For updating of an SAP Fiori catalog within PFCG mark the appropriate entry of an SAP Fiori catalog in the Menu PFCG role tab page and push the Details button. If you do that in a SAP Fiori front-end server, you can directly choose the SAP Fiori catalog which holds the definitions of the Fiori configurations. If you are in a back-end server, you have to choose an appropriate RFC connection to be able to connect to the SAP Fiori front-end server where the SAP Fiori catalogs are defined. Look for the right catalog and check the status of the applications which are available in that catalog.

The update of application groups in role menu is available in front- and back-end systems.

The PRGN_COMPARE_ROLE_MENU report offers navigation options to transactions PFCG and SUPC as well as the mass menu change function. For detailed information, see the program documentation on the initial screen of the report.

Note

See also SAP note 2465999 - Update of application groups in role menu.

Screenshots showing mass update of Application Groups in Role Menu.

The output of the PRGN_COMPARE_ROLE_MENU report shows application groups and the applications they contain which are inserted in the Menu PFCG tab page of the selected PFCG roles. The status shows whether the application group needs to be compared. The Comparison column informs you whether an application needs to be deleted from the menu or added to it. If errors or warnings occur during the evaluation of the application groups, you can display the messages by choosing the icon in the Messages for Application Group column.

The authorization status corresponds to the specification on the Authorizations tab in transaction PFCG.

The report can also be started from transaction SU25 (Upgrade Tool for Profile Generator) with the Update of Application Groups in Role Menu menu entry.

Creation of Roles

The PRGN_CREATE_FIORI_FRONTENDROLE program allows to maintain roles with menu options from selected SAP Fiori tile catalogs.

You can use the PRGN_CREATE_FIORI_FRONTENDROLE program to perform the mass maintenance of menu options from selected SAP Fiori tile catalogs. The assignment of the SAP Fiori tile catalogs to roles takes place by means of a table that you either create or upload manually or generate automatically by means of catalog selection.

Note

Depending on the scenario you can use it to create front-end roles in a hub deployment or to create roles in an embedded scenario.
Screenshots on creating SAP Fiori Front-End Roles.

Note

See also SAP note 2648554 - Creation of front-end roles for SAP Fiori launchpad.

Note

The following tools for role creation are available in hub deployment scenarios.

In hub deployment scenarios you can transfer the menu of an SAP Fiori front-end role to the role menu of an existing or new back-end role.

  • Transaction PFCG: Transfer of menus from front-end server:

    You are on the Menu tab in role menu processing. The function for copying a menu from another role from the front-end server is for appending the menu of the front-end role to the existing menu. When you do this, you can adjust the menu options for SAP Fiori tile catalogs.

  • Program PRGN_CREATE_FIORI_BACKENDROLES:

    You can use this program to create a back-end role for selected SAP Fiori front-end roles and to copy the relevant front-end role menu. If the back-end role already exists, the role menu of the back-end role is deleted and replaced by the role menu of the front-end role.

Screenshots showing the transferring of the menu of Front-End Roles in PFCG.

Description of the PRGN_CREATE_FIORI_BACKENDROLES report.

Enter the RFC destination of the front-end server from which the role menus should be copied. Then select one or more roles (asterisk possible only at end of search string) from the front-end server.

The name of the back-end role can be identical to the name of the front-end role or can be changed by means of a naming conversion:

  • The function for deleting a prefix allows you to delete a name component at the start of a role. If the prefix is not part of the name, an error message is output.
  • You can use the function for adding a prefix to insert a name component at the start of a role. Note that the role name is restricted to 30 characters.

The following options are available for the execution:

  • During the transfer of the role menu, you can adjust the menu options for SAP Fiori tile catalogs:
    • The RFC destination of the front-end server that you entered in the selection is entered as the new location for the remote front-end server in the SAP Fiori tile catalogs.
    • Applications that are assigned to the SAP Fiori tile catalogs on the front-end server and are started on the back-end server are included in the role menu as subnodes of the SAP Fiori tile catalog.
  • The profile and the authorizations of the back-end roles can be deleted and created anew. During the recreation process, authorizations are generated from the authorization default values of the applications in the menu and empty fields are defined with full authorization. The profiles of the roles are then generated. If you have not selected this option, you must adjust the authorizations in PFCG.

Menu options for invalid applications are deleted during the import.

Screenshots on creating Back-End Roles from Front-End Roles.

Practice System Exercise: Maintain Roles

Select Start Exercise to start the simulation.

Part 1

ExerciseStart Exercise

Part 2

ExerciseStart Exercise

Part 3

ExerciseStart Exercise

Note

If you have access to a practice system, you can now execute this exercise.

Business Example

As a role developer you are asked to adapt the role concept and the appropriate PFCG roles which contain SAP Fiori applications.

Task 1: Update of Application Groups in Role Menu

In a previous exercise you have modified the SAP Fiori catalog named ADM945_##_BC_FIN_ACCOUNT. The SAP Fiori App Manage Banks was replaced by the SAP Fiori AppManage Banks - Cash Management. In addition the change was also adopted to the Z_ADM945_##_BANK_MGMT page.

The role still contains the Manage Banks app in the ADM945_##_BC_FIN_ACCOUNTcatalog. Therefore it is necessary to update the application groups in role menu and to maintain the authorizations.

Steps

  1. Log on to the SAP GUI of the system S4D.

    FieldValue
    Usertrain-##
    Password

    Custom password

    1. Choose SAP Logon.

    2. Select 10 Development → S4D SAP GUI non-SNC [PAS].

    3. Choose Log On.

  2. Update the application groups in role menu of role ADM945_##_BR_FINANCIALS.

    1. Start the Role Maintenance transaction PFCG.

    2. In the Role field, enter ADM945_##_BR_FINANCIALS.

    3. Choose Change.

    4. Go to the Menu tab.

    5. Select your catalog Financial Accounting Catalog ## in the role menu.

    6. Choose Details.

      Result

      The pop displays that several IWSG and IWSV services which were proposed due to the Manage Banks app will be removed. The IWSG and IWSV services which were proposed due to the Manage Banks - Cash Management app will be added. This is because you removed an SAPUI5 application in the catalog and added another one.

    7. In the Change SAP Fiori Launchpad Catalog dialog box choose Continue to update the catalog in the role menu.

    8. Choose Save.

  3. Change the authorization data and generate a profile.

    1. Go to the Authorizations tab.

    2. Choose Change Authorization Data.

    3. Check which authorization objects were deleted and which were added.

    4. Choose Status to fill in the missing values and assign full authorization.

    5. In the Assign Full Authorization for Subtree dialog box, choose Execute to fill the empty authorization fields.

    6. Choose Generate (Shift + F5).

    7. Choose Back (F3).

    8. Choose Save.

Task 2: Mass Update of Application Groups in Role Menu

Modify the SAP Fiori catalog named ADM945_##_BC_FIN_ACCOUNT and perform a mass update the application groups in role menu.

Steps

  1. Log on to SAP Fiori Launchpad of system S4D with your train-## user. Use Google Chrome.

    FieldValue
    Usertrain-##
    Password

    Custom password

    1. In the Microsoft Windows start menu, choose Google Chrome.

    2. In Google Chrome, go to Bookmarks.

    3. In Bookmarks, choose 10 Development → s4dhost → 10 S4D SAP Fiori Launchpad.

      Note

      Since SAP S/4HANA 2020 tools for setting up launchpad content can be accessed fro SAP Fiori launchpad. To access these tools, you as an administrator need to have the relevant authorizations that are provided by SAP-delivered role SAP_FLP_ADMIN.

  2. From the group Fiori Launchpad, start FLP Content Manager: Client-Specific from the SAP Launchpad home screen.

    1. On the SAP Fiori Launchpad home screen, choose Fiori Launchpad group.

    2. Launch FLP Content Manager: Client-Specific app.

      Result

      The WebGui Transaction opens.

    3. Alternatively, you can start transaction /UI2/FLPCM_CUST from SAP GUI. To do so, enter /n/ui2/flpcm_cust in the OK field of the SAP GUI.

    4. Ensure that the Catalogs tab is selected.

  3. Modify the SAP Fiori catalog named ADM945_##_BC_FIN_ACCOUNT. Add Manage G/L Account Master Data app (app ID: F0731A).

    1. Search for your catalog ADM945_##_BC_FIN_ACCOUNT, for example, using the Search Catalogs field.

    2. At the bottom (area Content in Catalog...), choose Add Tiles/Target Mappings → Add Tiles/TMs to Selected Catalog.

    3. In the Add Tiles/Target Mappings as References to Catalog... screen, search for App ID F0731A, for example using the Search Tiles/Target Mappings field.

    4. Select the line for semantic object GLAccount and action manage.

    5. Choose Add Tile/TM Reference.

  4. Log on to the SAP GUI of the system S4D.

    FieldValue
    Usertrain-##
    Password

    Custom password

    1. Choose SAP Logon.

    2. Select 10 Development → S4D SAP GUI non-SNC [PAS].

    3. Choose Log On.

  5. Update the application groups in role menus.

    1. Start the Profile Generator: Upgrade and First Installation transaction SU25.

    2. Execute Update of Application Groups in Role Menus.

    3. In the Role field, enter ADM945_##*.

    4. Choose Execute.

      Result

      The resulting list indicates in the Comparison column that the IWSG service ZFAC_MANAGE_GLACCOUNT_SRV_0002 and the IWSV service FAC_MANAGE_GLACCOUNT_SRV_0002 are added to the catalog ADM945_##_BC_FIN_ACCOUNT of the role ADM945_##_BR_FINANCIALS.

    5. Select the role ADM945_##_BR_FINANCIALS and choose Adopt Menu.

    6. Choose Yesas answer for question Do you want to execute the changes.

    7. Choose Change role.

  6. Change the authorization data and generate a profile.

    1. Go to the Authorizations tab.

    2. Choose Change Authorization Data.

    3. Check which authorization objects were added.

    4. Choose Status to fill in the missing values and assign full authorization.

    5. In the Assign Full Authorization for Subtree dialog box, choose Execute to fill the empty authorization fields.

    6. Choose Generate (Shift + F5).

    7. Choose Back (F3).

    8. Choose Save.

    9. Choose Back (F3) to go back to the resulting list of roles .

Task 3: Mass Maintenance of Roles from selected SAP Fiori Tile Catalogs

Create new front-end roles for your SAP Fiori tile catalogs.

CatalogRole
ADM945_##_BC_FIN_ACCOUNTADM945_##_BR_GE_FIN_ACCOUNT
ADM945_##_BC_INVENTORY_MGMTADM945_##_BR_GE_INVENTORY_MGMT

Steps

  1. Log on to the SAP GUI of the system S4D.

    FieldValue
    Usertrain-##
    Password

    Custom password

    1. Choose SAP Logon.

    2. Select 10 Development → S4D SAP GUI non-SNC [PAS].

    3. Choose Log On.

  2. Create new front-end roles for your SAP Fiori tile catalogs.

    1. Start the ABAP Program Execution transaction SA38.

    2. In the Program field, enter PRGN_CREATE_FIORI_FRONTENDROLE.

    3. Choose Execute.

    4. In the Assigment of Fiori Tile Catalogs screen area, select Generation from Fiori Launchpad Catalogs.

    5. In the Fiori Launchpad Catalog field, enter ADM945_##*.

    6. In the Namespace for Role: Delete Prefix, enter ADM945_##_BC.

    7. In the Namespace for Role: Add Prefix, enter ADM945_##_BR_GE.

    8. Choose Execute.

    9. Check the name of the roles listed and choose Execute.

    10. In the Messages dialog box, choose Continue.

    11. Choose Back.

Log in to track your progress & complete quizzes

Learning

SAP FacebookSAP YoutubeSAP LinkedIn